The vulnerability in SimpleSAMLphp's SAML SP Assertion Consumer Service (ACS) path arises because it does not enforce that the IdP responding matches the expected IdP stored in the SP state for SP-initiated logins. When an unsigned Response element's InResponseTo attribute is combined with a signed assertion missing SubjectConfirmationData/InResponseTo, the SP accepts the response from an unexpected IdP. This allows a lower-trust IdP to satisfy SP state created for a different expected IdP, potentially bypassing restrictions such as disabling unsolicited logins. The issue is particularly impactful in environments trusting multiple IdPs with different assurance levels or attribute namespaces, where application authorization depends on the selected IdP. Exploitation depends on the attacker's ability to obtain a signed assertion from a lower-trust IdP and on how the application maps user identifiers.

This vulnerability can lead to authentication and authorization bypass in multi-IdP deployments by allowing a response from a lower-trust or unintended IdP to be accepted as valid for a session expecting a different IdP. This undermines the SP's intended routing and trust boundaries, potentially granting unauthorized access or elevated privileges if the application relies on the IdP identity for authorization decisions. The impact is limited to deployments where multiple IdPs with differing trust levels are configured and where the attacker can obtain a signed assertion from a lower-trust IdP.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, administrators should review their multi-IdP configurations and consider isolating trust boundaries or disabling SP-initiated flows if possible. Monitoring for unexpected IdP responses and applying strict validation of InResponseTo attributes within signed assertions may help mitigate risk until an official fix is available.